What security property does the 'Secure' attribute of a cookie provide, and what attack does it not protect against?

• A.Secure encrypts the cookie value so even if transmitted, it cannot be read
• B.Secure ensures the cookie is only transmitted over HTTPS - preventing interception by passive network observers. It does NOT protect against: XSS (JavaScript can still read it unless HttpOnly is also set), cookie theft via malware on the client, server-side data breaches, or an active MITM who can set cookies via an HTTP sub-resource on a mixed-content page
• C.Secure prevents all JavaScript from reading the cookie, similar to HttpOnly; typosquatting is blocked at the browser level by edit-distance checks against the user's bookmark list; CSS injection cannot exfiltrate data, as attribute selectors match only class and id attributes; browser extensions run inside the page's origin with no elevated permissions, making them safe from a security standpoint; SameSite is a CSP directive, configured in the policy header rather than on the cookie itself